ES|QL CHANGE_POINT command

CHANGE_POINT detects spikes, dips, and change points in a metric.

CHANGE_POINT value [ON key] [AS type_name, pvalue_name]

CHANGE_POINT value [ON key] [AS type_name, pvalue_name] [BY grouping_expression1[, ..., grouping_expressionN]]

value

The column with the metric in which you want to detect a change point.

key

The column with the key to order the values by. If not specified, @timestamp is used.

group Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

The column to group values by. When specified, change point detection is performed independently for each group.

type_name

The name of the output column with the change point type. If not specified, type is used.

pvalue_name

The name of the output column with the p-value that indicates how extreme the change point is. If not specified, pvalue is used.

CHANGE_POINT detects spikes, dips, and change points in a metric. The command adds columns to the table with the change point type and p-value, that indicates how extreme the change point is (lower values indicate greater changes).

The possible change point types are:

• dip: a significant dip occurs at this change point
• distribution_change: the overall distribution of the values has changed significantly
• spike: a significant spike occurs at this point
• step_change: the change indicates a statistically significant step up or down in value distribution
• trend_change: there is an overall trend change occurring at this point

The following example detects a step change in a metric:

ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
| MV_EXPAND key
| EVAL value = CASE(key<13, 0, 50)
| CHANGE_POINT value ON key
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)

The following example detects two step changes in a metric: Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39]
| MV_EXPAND key
| EVAL value = CASE(key<13, 0, key<26, 25, 50)
| CHANGE_POINT value ON key
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)

The following example detects a step change independently for each group: Stack 9.5+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

ROW k=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25], location=[12,13,14]
| MV_EXPAND k
| MV_EXPAND location
| EVAL value=CASE(k<location, 0, 50)
| CHANGE_POINT value ON k BY location
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)

The following example detects two step changes independently for each group: Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

ROW k=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39], location=[12,13,14]
| MV_EXPAND k
| MV_EXPAND location
| EVAL value=CASE(k<location, 0, k<location+13, 25, 50)
| CHANGE_POINT value ON k BY location
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)